io.github.Fizzl13/x402-doctor

Est-ce que io.github.Fizzl13/x402-doctor est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.Fizzl13/x402-doctor » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 13 outils

• check_payment_proof≈ 372 tokens

  Free: after paying an x402 endpoint, pass the PAYMENT-RESPONSE header it returned (X-PAYMENT-RESPONSE in v1). Returns the transaction, network and payer it names, whether that transaction exists on-chain and succeeded, and which USDC moved from whom to whom, with an explorer link. Read-only. Limited to 10 calls per hour.

  Paramètres, retour & exemple (1)

  Paramètres

  • header · string · requis
    The PAYMENT-RESPONSE header value (base64 JSON)

  Exemple d'appel

  {"name": "check_payment_proof", "arguments": {"header": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"checks": [], "decoded": {}, "onchain": "texte", "overall": "texte", "explorer": "texte"}}

• feedback≈ 317 tokens

  Report a bug, a missing feature or anything else about this service, in a structured way. Free. A person reads every report; nothing is run or changed automatically.

  Paramètres, retour & exemple (4)

  Paramètres

  • type · string · optionnel · bug | feature | other
    bug, feature (something missing) or other
  • contact · string · optionnel
    Optional: how to reach you about it
  • message · string · requis
    What happened or what you need
  • endpoint · string · optionnel
    Optional: the route or tool it is about, e.g. /v1/token

  Exemple d'appel

  {"name": "feedback", "arguments": {"message": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "texte", "note": "texte", "type": "texte", "service": "texte", "received": true}}

• verify_receipt≈ 528 tokens

  Free: check the signed receipt that every paid x402 Doctor answer carries (diagnose, preflight, batch, deep, fix, delivery check; HTTP or MCP), for example to prove later which verdict you got before paying an endpoint. Pass the whole answer as response. Returns valid, the signer and whether it is an x402 Doctor signer; with route and input also whether the receipt is for exactly that request. A changed verdict or receipt fails. Read-only, nothing is stored. Same as POST /api/v1/verify.

  Paramètres, retour & exemple (3)

  Paramètres

  • input · object · optionnel
    The tool arguments you sent (MCP), or the query parameters as strings (HTTP)
  • route · string · optionnel
    The request it answered: "mcp <tool name>" for an MCP answer (e.g. "mcp x402_preflight"), "GET /api/v1/preflight" for an HTTP one
  • response · object · requis
    The whole paid answer as you received it, including its receipt

  Exemple d'appel

  {"name": "verify_receipt", "arguments": {"response": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"valid": true, "reason": "texte", "signer": "texte", "known_signer": true, "input_matches": true, "signer_status": "texte"}}

• x402_delivery_check≈ 536 tokens

  Paid ($0.25 via x402 in USDC on Base, Solana, Algorand or Stellar, or in RLUSD on the XRP Ledger): not a reading but a purchase. x402 Doctor buys the endpoint once (at most $0.1, USDC on Base, from its own wallet) with the example input its listing declares, checks the answer against the declared output schema and measures the charge on chain. Answers with a job id at once; follow it with x402_delivery_status (free), the result usually comes within minutes. The endpoint must get a "go" from the pre-payment check and be payable in USDC on Base; otherwise it is refused before payment. Same as GET /api/v1/delivery-check. The answer carries a signed receipt (EIP-191, bound to your arguments) that proves later which verdict you got.

  Paramètres, retour & exemple (2)

  Paramètres

  • url · string · requis
    The x402 endpoint to buy once (https, someone else's, payable in USDC on Base)
  • method · string · optionnel · GET | POST
    HTTP method of the paid route (default: GET, then POST)

  Exemple d'appel

  {"name": "x402_delivery_check", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "texte", "url": "texte", "status": "texte", "accepts": "texte", "receipt": "texte", "status_url": "texte", "endpoint_price_usd": 1}}

• x402_delivery_status≈ 318 tokens

  Free: the status of a delivery check ordered with x402_delivery_check (or GET /api/v1/delivery-check): awaiting_payment, queued or done, and once done the result: paid_and_delivered, the outcome, the charge measured on chain and the transaction.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    The job id x402_delivery_check answered with

  Exemple d'appel

  {"name": "x402_delivery_status", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "texte", "url": "texte", "result": "texte", "status": "texte", "status_url": "texte"}}

• x402_diagnose≈ 505 tokens

  Paid ($0.01 via x402 in USDC on Base, Solana, Algorand or Stellar, or in RLUSD on the XRP Ledger): diagnose an x402 endpoint the way a paying agent would, without paying it: the 402 challenge format, every accepts[] option, the resource URL, Solana settlement readiness, which wallets can pay, Bazaar/OpenAPI discovery and the browser paywall. Returns every check with pass/warn/fail and a fix hint. For the endpoint's owner or a developer debugging it; to decide whether to pay someone else's endpoint, use x402_preflight. Same as GET /api/v1/diagnose. The answer carries a signed receipt (EIP-191, bound to your arguments) that proves later which verdict you got.

  Paramètres, retour & exemple (2)

  Paramètres

  • url · string · requis
    The x402 endpoint (public http(s) URL), e.g. https://api.example.com/paid
  • method · string · optionnel · GET | POST
    HTTP method of the paid route (default: GET, then POST)

  Exemple d'appel

  {"name": "x402_diagnose", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"url": "texte", "checks": "texte", "accepts": "texte", "overall": "texte", "receipt": "texte"}}

• x402_fix≈ 532 tokens

  Paid ($0.05 via x402 in USDC on Base, Solana, Algorand or Stellar, or in RLUSD on the XRP Ledger): diagnoses your x402 endpoint, then returns per problem the concrete change as code for your stack (express, next, hono, node, python, generic), filled in with your own payTo, amount, network and route. For the endpoint's owner: includes the diagnosis, so there is no need to call x402_diagnose first. Same as GET /api/v1/fix. The answer carries a signed receipt (EIP-191, bound to your arguments) that proves later which verdict you got.

  Paramètres, retour & exemple (3)

  Paramètres

  • url · string · requis
    The x402 endpoint (public http(s) URL), e.g. https://api.example.com/paid
  • stack · string · optionnel · express | next | hono | node | python | generic
    Your server stack (default: detected)
  • method · string · optionnel · GET | POST
    HTTP method of the paid route (default: GET, then POST)

  Exemple d'appel

  {"name": "x402_fix", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"url": "texte", "fixes": "texte", "accepts": "texte", "overall": "texte", "receipt": "texte", "summary": "texte", "unfixed": "texte"}}

• x402_preflight≈ 716 tokens

  Paid ($0.001 via x402 in USDC on Base, Solana, Algorand or Stellar, or in RLUSD on the XRP Ledger): call this before your agent pays an x402 endpoint. Returns go, caution or no_go, the recommended payment option, and why: payment would fail, the seller's payout address is on the OFAC SDN sanctions list, over your budget (max_usd), price above what is advertised, not HTTPS, unknown token, its 30-day track record. Never pays the endpoint. The buyer's check for one call; for several endpoints at once use x402_preflight_batch, before a payment above about $1 x402_preflight_deep, and to debug your own endpoint x402_diagnose. Same as GET /api/v1/preflight. The answer carries a signed receipt (EIP-191, bound to your arguments) that proves later which verdict you got.

  Paramètres, retour & exemple (5)

  Paramètres

  • url · string · requis
    The x402 endpoint (public http(s) URL), e.g. https://api.example.com/paid
  • client · string · optionnel · gateway
    Set to gateway when your agent pays with Circle's Gateway client (@circle-fin/x402-batching) from a Gateway balance: Gateway-only endpoints are then not a caution, and Gateway options are recommended first.
  • method · string · optionnel · GET | POST
    HTTP method of the paid route (default: GET, then POST)
  • max_usd · number · optionnel
    Your budget per call in USD, e.g. 0.05
  • network · string · optionnel
    CAIP-2 network you want to pay on, e.g. eip155:8453

  Exemple d'appel

  {"name": "x402_preflight", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"url": "texte", "accepts": "texte", "options": "texte", "reasons": "texte", "receipt": "texte", "summary": "texte", "verdict": "texte", "safe_to_pay": true}}

• x402_preflight_batch≈ 607 tokens

  Paid ($0.005 via x402 in USDC on Base, Solana, Algorand or Stellar, or in RLUSD on the XRP Ledger): the pre-payment check for up to 10 x402 endpoints at once. Per endpoint go, caution or no_go, the recommended payment option and why, plus totals. For marketplaces and agents that weigh several services. Never pays the endpoints. Same as GET /api/v1/preflight/batch. The answer carries a signed receipt (EIP-191, bound to your arguments) that proves later which verdict you got.

  Paramètres, retour & exemple (5)

  Paramètres

  • urls · array · requis
    The x402 endpoints to check (public http(s) URLs), at most 10
  • client · string · optionnel · gateway
    Set to gateway when your agent pays with Circle's Gateway client (@circle-fin/x402-batching) from a Gateway balance: Gateway-only endpoints are then not a caution, and Gateway options are recommended first.
  • method · string · optionnel · GET | POST
    HTTP method of the paid route (default: GET, then POST)
  • max_usd · number · optionnel
    Your budget per call in USD, e.g. 0.05
  • network · string · optionnel
    CAIP-2 network you want to pay on, e.g. eip155:8453

  Exemple d'appel

  {"name": "x402_preflight_batch", "arguments": {"urls": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"count": 1, "counts": "texte", "accepts": "texte", "receipt": "texte", "results": "texte"}}

• x402_preflight_deep≈ 637 tokens

  Paid ($0.01 via x402 in USDC on Base, Solana, Algorand or Stellar, or in RLUSD on the XRP Ledger): for expensive calls. The pre-payment verdict (go, caution or no_go) plus the full diagnosis, the 30-day history per day, how reliable the seller's other endpoints are and whether the endpoint moved domains. Never pays the endpoint. Worth it before a payment above about $1; for an ordinary call x402_preflight is enough. Same as GET /api/v1/preflight/deep. The answer carries a signed receipt (EIP-191, bound to your arguments) that proves later which verdict you got.

  Paramètres, retour & exemple (5)

  Paramètres

  • url · string · requis
    The x402 endpoint (public http(s) URL), e.g. https://api.example.com/paid
  • client · string · optionnel · gateway
    Set to gateway when your agent pays with Circle's Gateway client (@circle-fin/x402-batching) from a Gateway balance: Gateway-only endpoints are then not a caution, and Gateway options are recommended first.
  • method · string · optionnel · GET | POST
    HTTP method of the paid route (default: GET, then POST)
  • max_usd · number · optionnel
    Your budget per call in USD, e.g. 0.5
  • network · string · optionnel
    CAIP-2 network you want to pay on, e.g. eip155:8453

  Exemple d'appel

  {"name": "x402_preflight_deep", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"url": "texte", "accepts": "texte", "options": "texte", "reasons": "texte", "receipt": "texte", "summary": "texte", "verdict": "texte", "safe_to_pay": true}}

• x402_quick_check≈ 341 tokens

  Free: does this x402 endpoint work for a paying agent? Returns pass, warn or fail with the number of problems and the top three. Limited to 10 calls per hour. For every check use x402_diagnose ($0.01); for code changes x402_fix ($0.05); before paying someone else's endpoint x402_preflight ($0.001).

  Paramètres, retour & exemple (2)

  Paramètres

  • url · string · requis
    The x402 endpoint (public http(s) URL), e.g. https://api.example.com/paid
  • method · string · optionnel · GET | POST
    HTTP method of the paid route (default: GET, then POST)

  Exemple d'appel

  {"name": "x402_quick_check", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"url": "texte", "next": "texte", "overall": "texte", "failures": 1, "warnings": 1, "top_problems": []}}

• x402_trust_add≈ 394 tokens

  Free: add your own paid endpoint to the x402 Trust Index when no registry lists it yet (CDP Bazaar, Circle's Agent Marketplace, GoPlausible, MPP directory). x402 Doctor first checks that it answers 402 with a payment challenge (x402, MPP or L402); the next daily scan starts its record, which buyers' agents see before they pay. At most 25 endpoints per host. Limited to 10 calls per hour.

  Paramètres, retour & exemple (1)

  Paramètres

  • url · string · requis
    The x402 endpoint (public http(s) URL), e.g. https://api.example.com/paid

  Exemple d'appel

  {"name": "x402_trust_add", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"ok": true, "url": "texte", "check": "texte", "error": "texte", "status": "texte", "message": "texte", "verdict": "texte"}}

• x402_trust_record≈ 437 tokens

  Free: the daily track record of a paid x402 or MPP endpoint from the x402 Trust Index: on how many of the last 30 scanned days an agent could pay it, the latest verdict and reasons, price and networks. found: false when it is not in the index; add your own endpoint with x402_trust_add. Limited to 10 calls per hour. Before paying, x402_preflight ($0.001) checks the live 402 and includes this record.

  Paramètres, retour & exemple (1)

  Paramètres

  • url · string · requis
    The x402 endpoint (public http(s) URL), e.g. https://api.example.com/paid

  Exemple d'appel

  {"name": "x402_trust_record", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"url": "texte", "last": "texte", "found": true, "last_scan": "texte", "submitted": true, "how_to_list": "texte", "days_checked": 1, "days_payable": 1, "payable_ratio": 1}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://x402-doctor.fizzl.eu/mcp